How do you help organisations move away from checklist-driven compliance and towards meaningful cyber risk management that supports business objectives?

So checklists have their place and obviously we can't.

get away from compliance, there are reasons, particularly with, you know, sort of regulated organizations and things like that, where they have to prove that they've got compliant processes in place, et cetera.

I think it kind of links back to the answer to the first question, in that rather than having a checklist that says, has everything got MFA or are we running backups everywhere, is asking different questions related to business harm if something goes wrong.

So instead of asking, do we have MFA anywhere, we should be asking questions around where are the accounts and where is the information that could be harmed if someone gained unauthorized access and then determining whether well, okay, we've identified what those places are.

We now need to determine what the most appropriate course of action is.

And MFA might be one of those things, but other access controls and levels of authorization, et cetera, could also be added to the list.

eye on sorry it might just seem faster paced because we're getting older but